This English version is provided for convenience. If it differs from the Turkish version, the Turkish version prevails.
This notice is issued by IRON LABS TEKNOLOJİ ANONİM ŞİRKETİ (“Eventora”, “we”), which provides the Eventora service, under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. It explains for what purposes, on what legal grounds and by what methods we process your personal data, to whom we transfer it, how long we keep it, and how you can exercise your rights under Article 11 of the KVKK.
A plain-language overview is in our Privacy Policy, and what is stored in your browser and on your device is in our Cookie Policy. To exercise your rights, you can use the Data Subject Request Form.
1. Data controller
| Item | Details |
|---|---|
| Company name | IRON LABS TEKNOLOJİ ANONİM ŞİRKETİ |
| Brand | Eventora |
| Address | GÖRELE MAH. USTA SK. NO: 28 İÇ KAPI NO: 1 BEYKOZ/İSTANBUL |
| MERSİS number | 0466190147300001 |
| KEP (registered electronic mail) address | ironlabsteknoloji@hs06.kep.tr |
| Personal data requests | kvkk@eventora.com.tr |
| Website | https://eventora.com.tr |
1.1 Our roles
Eventora processes personal data in two different capacities:
- As data controller: data of visitors to our website, of planners who open a Eventora account, of the people who join their team, and of the people whose billing details are entered. We decide the purposes and means of this processing (sections 3 and 4).
- As data processor: guest data that planners upload or enter into their guest lists. The controller of this data is the planner or organisation holding the event. Eventora processes it only on the planner’s behalf, on their instructions and within the limits set in the Data Processing Agreement (section 5).
2. Who this notice covers
- Website visitors (https://eventora.com.tr).
- Account holders and team members: planners, account members, employees, event hosts and people in the organisation role who use the web app (https://app.eventora.com.tr) or our iOS and Android apps, and people invited to a team.
- Guests: people a planner adds to a guest list, and the people named as coming with them.
Eventora does not currently accept job applications, so processing of job applicants’ data is outside the scope of this notice.
3. Website visitors
Our website uses no analytics, advertising or tracking cookies and sets no cookies in your browser. The theme (light or dark) you choose and whether you paused the animations are kept only in your browser’s local storage and are not sent to us. See the Cookie Policy for details.
| Data category | Purpose | Legal ground | Collection method |
|---|---|---|---|
| Transaction security: IP address, browser and device information, requested page, time of request | Serving the website to you, information security, detecting and preventing attacks and misuse | KVKK Art. 5/2-f (legitimate interest); Art. 5/2-ç (legal obligation) when authorities request it | Automatically when you visit the site, through our infrastructure and security provider Cloudflare |
| Identity and contact: name, email address, phone number if you share it | Answering you, assessing your question or request | Art. 5/2-c (directly related to entering into a contract), Art. 5/2-f | Electronically, when you email us |
| Content of your request and correspondence | Same | Same | Same |
| Demo request: name, company name, phone number, email address, how you heard about us, anything you add, the email addresses of other attendees if you add them, the day and time you choose | Arranging and holding the demo call, getting back to you, measuring which channels people hear about us through | Art. 5/2-c (directly related to entering into a contract), Art. 5/2-f | Electronically, when you fill in the booking form on the demo page (https://eventora.com.tr/en/demo/), through our booking provider Cal.com |
4. Account holders and team members
This section covers planners who open a Eventora account, people who join or are invited to an account’s team (account members, employees, event hosts and people in the organisation role), and people whose billing profile is entered.
| Data category | Purpose | Legal ground | Collection method |
|---|---|---|---|
| Identity: first and last name | Creating and managing the account, providing the service, showing who did what in the team | Art. 5/2-c | From you at sign-up; from Google or Apple when you sign in with them; from the person who invites you to a team |
| Contact: email address, mobile phone number | Signing in, verifying your email address, resetting your password, sending team invitations by email or WhatsApp, billing and service notifications | Art. 5/2-c, Art. 5/2-f | From you at sign-up and sign-in; from the person who invites you to a team |
| Sign-in and account security: Firebase user id, sign-in method, time of last sign-in, email verification status, session cookie, app verification (App Check) tokens, a hash of the team invitation link, server logs containing IP address and browser information | Authentication, preventing unauthorised access and automated attacks, information security | Art. 5/2-c, Art. 5/2-f; Art. 5/2-ç when authorities request it | Automatically, through Firebase Authentication, Firebase App Check, Cloudflare and Google Cloud |
| Phone sign-in: phone number, a keyed hash of the code sent (the code itself is not stored), a keyed hash of the IP address, channel (WhatsApp or SMS), language, sending and delivery status, number of wrong attempts | Enabling sign-in with a phone number, delivering the code, enforcing sending and attempt limits, preventing misuse | Art. 5/2-c, Art. 5/2-f | From you on the sign-in screen; delivery status automatically from Meta (WhatsApp) and the SMS provider |
| Account and usage: account, event and team records, roles and invitations, message templates, communication campaigns, credit transactions; language, date and time format and time zone preferences | Providing the service, applying roles and permissions, keeping the credit balance and spending accurate | Art. 5/2-c, Art. 5/2-f | Electronically, as you use the app |
| Billing profile: name or company name, Turkish ID number or tax number, tax office, address, province, district, postal code, email address, mobile phone number | Issuing and sending the invoice (e-Arşiv or e-Fatura), passing the buyer’s details to the payment institution, obligations under tax and commercial law | Art. 5/2-a (expressly provided for by the Tax Procedure Law No. 213 and related legislation), Art. 5/2-ç, Art. 5/2-c | From you in the billing profile form |
| Payment and transaction: credits bought, amount, payment status, iyzico payment references, IP address at payment, invoices issued. Card details are entered only on iyzico’s payment page and never reach us. | Taking and verifying the payment, adding credits to the account, preventing fraud, handling withdrawal and refund requests, accounting | Art. 5/2-c, Art. 5/2-ç, Art. 5/2-e, Art. 5/2-f | From you at checkout; the payment result automatically from iyzico |
| Support correspondence: name, email address, content and attachments | Answering requests and complaints, handling withdrawals and refunds | Art. 5/2-c, Art. 5/2-e, Art. 5/2-f | From the emails you send us |
| Legal matters: notices, dispute records, requests from public authorities | Conducting legal proceedings, answering competent authorities | Art. 5/2-ç, Art. 5/2-e | During the relevant process |
When you sign in with Google or Apple, they send us your name and email address. If you use Apple’s “Hide My Email”, we receive Apple’s relay address instead of your real one.
We do not send you commercial electronic messages (promotions or campaigns). If we ever do, we will first ask for your consent under Law No. 6563 and the rules of the Message Management System (İYS). Service messages such as invoices, team invitations, email verification and sign-in codes are not commercial messages.
5. Guests
5.1 Who is responsible for your data?
If you were added to a guest list, the controller of your data is the planner who invited you (the person, agency, venue or organisation holding the event). Eventora processes this data as a processor under Article 12 of the KVKK and the Data Processing Agreement it has with the planner, only on the planner’s behalf and on their instructions.
The planner decides for what purpose and on what legal ground your data is processed, and whether you are sent messages or called. The planner warrants to Eventora that they have a valid legal ground to give us your data and to contact you, and that they have informed you. This section does not replace the planner’s own duty to inform you; it is here to tell you about Eventora‘s role.
5.2 Data processed on the planner’s behalf
| Data category | Purpose on the planner’s behalf | Legal ground | Collection method |
|---|---|---|---|
| Identity: first and last name; names of the people coming with you (if the planner entered them) | Building the guest list, sending personalised invitations and reminders, tracking attendance | Decided by the planner as controller | Entered by the planner by hand, from an uploaded Excel list, or picked from the phone’s contacts in the mobile app |
| Contact: mobile phone number; the fact that the number is not on WhatsApp | Sending invitations, reminders and information by WhatsApp or SMS; placing voice calls | Decided by the planner | From the planner; whether the number is on WhatsApp automatically from Meta |
| Event and attendance: RSVP (Attending, Awaiting reply, Maybe, Declined), party size, tag or group, message language, seating, number of reminders sent | Planning attendance and seating | Decided by the planner | From the planner; your answers from you (WhatsApp buttons or voice call) |
| Communication records: text of the messages sent to you, time sent, delivery and read status, error information; the reply buttons you tap and the messages you write on WhatsApp | Delivering messages, tracking delivery, showing your answers to the planner, calculating cost | Decided by the planner | Automatically from Meta and the SMS providers; your answers from you |
| Voice call records: number called, time and length of the call, outcome (answered, no answer, voicemail, callback), the RSVP and party size you gave, notes, your callback request and preferred time, a written transcript and summary of the call; an audio recording if the call is recorded | Collecting your RSVP and passing it to the planner, fulfilling your callback request | Decided by the planner | From you during the AI voice call; automatically |
| Import records: the Excel file the planner uploaded, a few sample rows used for column mapping, per-row warnings | Importing the list correctly | Decided by the planner | From the file the planner uploaded |
5.3 Messages and calls you may receive
For each communication campaign the planner chooses one channel: WhatsApp, SMS or a voice call. Guests are not emailed, guests never sign in to Eventora, and there is no public RSVP page.
- WhatsApp: Messages are sent from Eventora‘s WhatsApp Business number through Meta’s WhatsApp Business Cloud API, on the planner’s behalf, and say that they are sent via Eventora. You can answer with the buttons in the invitation. Writing “STOP” (or “DUR”) stops WhatsApp messages sent through Eventora; writing “START” (or “BAŞLA”) turns them back on.
- SMS: Sent through Verimor to Turkish numbers and Twilio to numbers abroad, with the sender name “EVENTORA”. SMS only informs; replies to an SMS are not read and are not recorded as an RSVP.
- AI voice call: The call is placed by an artificial intelligence assistant running on LiveKit over Verimor’s telephone network. At the start of the call the assistant says that it is an AI assistant calling on the planner’s behalf via Eventora. Calls are placed only during allowed hours, with a limited number of retries. The assistant records your RSVP, party size, notes and callback request; the transcript and summary are shared with the planner. If the call is recorded, the assistant also says so at the start. You can end the call at any time.
These messages carry invitations, reminders and event information; they are informational and contain no promotions.
5.4 Limited processing Eventora does on its own behalf
In the following, Eventora relies on its own legitimate interest (Art. 5/2-f) and legal obligations (Art. 5/2-ç), independently of the planner:
- Opt-out list: When you write “STOP” on WhatsApp, a keyed hash (HMAC) of your number, not the number itself, is recorded so that no planner can send you WhatsApp messages through Eventora. It is kept even if the planner deletes your entry or closes their account, so that your request is honoured.
- Billing records: The status and cost of the messages sent and calls placed are kept for accounting after your name, number and the message content are deleted, without being linked to you.
- Information security and preventing misuse: monitoring undelivered messages and block and complaint rates.
5.5 How guests can exercise their rights
- We recommend sending your request first to the planner who invited you; as controller, the planner decides whether to correct or delete your data or stop contacting you. The planner’s contact details are usually in the invitation.
- If you cannot reach the planner, or if you prefer, you can also apply to Eventora (section 12). Giving the event name and date, the planner’s name and the number the message or call came from helps us match you to the right planner.
- As processor, we forward your request to the planner without delay and help them answer it. We answer directly the part that concerns the processing we do on our own behalf (section 5.4).
- To stop WhatsApp messages, you can write “STOP”.
6. Special categories of personal data
Eventora does not ask for special categories of personal data such as health, religion, sect or ethnic origin, and offers no field for them. However, notes that planners type into free-text fields, or what guests volunteer during a voice call (for example a diet or a health condition), may contain such information. We ask planners not to enter such data unless necessary, and guests do not have to share it during a call.
7. Recipients of personal data
We transfer personal data under Articles 8 and 9 of the KVKK, only to the extent needed for the relevant purpose, to the recipients below. We send our service providers the least data that does the job.
| Recipient | Purpose | Data transferred |
|---|---|---|
| Google Cloud (Cloud Run, Cloud SQL, Cloud Storage, Cloud Tasks) | Hosting the application and its data | All data processed in the service |
| Google Firebase (Authentication, App Check), Google reCAPTCHA Enterprise; in the mobile app, Apple App Attest and DeviceCheck, Google Play Integrity | Signing in, email verification and password reset emails, app and device verification, preventing automated attacks | Sign-in data, email address, phone number, device and browser information, IP address |
| Google and Apple (sign-in providers) | Verifying your identity when you choose to sign in with them | Sign-in data |
| Anthropic (the Claude AI model), directly or through Google Cloud Vertex AI | Proposing the column mapping of an Excel guest list; finding tables and chairs on a floor plan | Column headers and at most 5 sample rows with phone numbers masked and email addresses hidden; the floor plan’s image and the text on it |
| Meta Platforms (WhatsApp Business Cloud API) | Sending WhatsApp messages, phone sign-in codes and team invitations; receiving replies | Phone number, message content, replies |
| Verimor (Turkey) | Sending SMS to +90 numbers; the telephone network for voice calls | Phone number, SMS text, call audio |
| Twilio | Sending SMS to numbers abroad | Phone number, SMS text |
| LiveKit, and the voice agent’s speech recognition, speech synthesis and language model providers | Running AI voice calls | Call audio, transcript, the guest’s name and party size, event details |
| Amazon Web Services (Amazon SES) | Sending emails such as invoices and team invitations | Email address, name, email content and attachments |
| Cloudflare | Domain name system (DNS), content delivery, security, serving the web app, routing incoming email | IP address, request data, incoming emails |
| Google (mailbox) | Reading and answering emails sent to us | Support correspondence |
| Cal.com (booking service; Cal Video for the video call, on Daily.co’s infrastructure) | Scheduling the demo call, sending confirmation and reminder emails, holding the call | The details in the demo request, IP address and browser information, the call’s video and audio (not recorded) |
| iyzico (Turkey) | Taking payment, 3-D Secure verification, fraud prevention, refunds | Name, Turkish ID or tax number, email, mobile phone, address, IP address, amount |
| E-invoice / e-Arşiv integrator (Turkey) and the Revenue Administration (GİB) | Issuing and delivering the invoice | Billing profile details, amount |
| Accountant, lawyers and auditors | Accounting, legal advice and audit | Data needed for the matter |
| Competent public authorities and courts | Fulfilling legal obligations | Data requested |
| The planner and their team (for guest data) | Providing the service to the controller | Guest data, replies, call results |
8. Transfers abroad
Our servers are in Google Cloud’s europe-west1 region in Belgium, and some of our service providers are abroad. Personal data is therefore transferred abroad. We make these transfers under Article 9 of the KVKK (as amended by Law No. 7499 in 2024) and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad:
- If the Personal Data Protection Board has issued an adequacy decision for the destination country, the transfer relies on it.
- Without an adequacy decision, one of the conditions in Article 5 or 6 must be met and an appropriate safeguard provided. We use the standard contract announced by the Board as that safeguard, and we notify each signed standard contract to the Personal Data Protection Authority within 5 business days of signature.
- If neither a standard contract nor another appropriate safeguard is possible, only the incidental transfers listed in Article 9/6 may be relied on, and explicit consent, given after being informed of the possible risks, only as a last resort.
| Recipient | Country or region | Purpose | Basis for transfer |
|---|---|---|---|
| Google (Google Cloud) | Belgium (europe-west1); Google’s other locations for support and security operations | Hosting, database, file storage, background jobs | Standard contract (Art. 9/4-c) |
| Google (Firebase Authentication, App Check, reCAPTCHA Enterprise) | United States and Google’s other locations | Sign-in, app verification, security | Standard contract |
| Anthropic (Claude) | United States; Google’s chosen region if Vertex AI is used | Column mapping, reading floor plans | Standard contract |
| Meta Platforms (WhatsApp) | United States and Meta’s other locations | WhatsApp messages | Standard contract |
| Twilio | United States | SMS to numbers abroad | Standard contract |
| LiveKit and the voice agent’s AI providers | United States and the providers’ chosen regions | Voice calls | Standard contract |
| Amazon Web Services (Amazon SES) | European Union (Frankfurt, Germany) | Sending email | Standard contract |
| Cloudflare | United States and Cloudflare’s global network | Domain names, content delivery, security, email routing | Standard contract |
| Google (mailbox) | United States and Google’s other locations | Support correspondence | Standard contract |
| Cal.com (and Daily.co) | United States | Demo booking and video call | Standard contract |
Verimor, iyzico and the e-invoice integrator are service providers established in Turkey.
9. Retention periods
We keep personal data only as long as the purpose requires and as long as the law requires. When the period ends, the data is deleted, destroyed or anonymised under the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.
| Data | Retention |
|---|---|
| Account data (identity, contact, preferences) | While the account is open. When you delete your account, your Firebase user is deleted and your name, email address and phone number are removed from your user record at once. |
| Phone sign-in records | Deleted 2 days after they are created. |
| Billing profile, payments, invoices and credit transactions | 5 years under the Tax Procedure Law No. 213 and 10 years under the Turkish Commercial Code No. 6102; kept for these periods even after the account is closed. |
| Support correspondence | After the request is resolved, for the statutory limitation periods for possible disputes. |
| Demo requests | Deleted from Cal.com within 1 year of the call at the latest, unless you open an account or another call is booked. |
| Server and security logs | A limited period, for security. |
| Uploaded Excel guest list file | Deleted when the import is done; in any case deleted automatically no later than 30 days after upload. |
| Floor plan files | Deleted when the planner uploads a new plan or deletes the plan or the event; the plan in use is kept with the event. |
| Guest data, in an event that has not contacted anyone | Deleted at once when the planner deletes the guest or the event. |
| Guest data, in an event that has contacted guests (messages sent or calls placed) | When the planner deletes the event, it is archived and kept while the planner’s account is open. |
| Guest data, when the planner’s account is closed | 30 days after the account closes, the guests, the texts and numbers of messages, and the calls’ numbers, outcomes, summaries, transcripts and recordings are deleted. The status and cost of messages and calls remain, without identities. |
| Opt-out list (WhatsApp “STOP”) | While the service runs, as a keyed hash of the number. |
10. Artificial intelligence and automated processing
Some Eventora features use artificial intelligence:
- Excel guest list import: Anthropic’s Claude model proposes which column holds the first name, last name, phone, party size or tag. Claude sees only the column headers and at most 5 sample rows, with phone numbers masked and email addresses hidden. Nothing is imported until the planner confirms the proposal; the whole list is never sent to Claude. When Claude is unavailable, the proposal is made from keywords in the headers.
- Reading floor plans: Claude finds the tables, chairs and capacities on the floor plan the planner uploads. The planner reviews, corrects and accepts the result.
- Voice calls: The assistant that calls guests is an AI and says so at the start of the call (section 5.3). The planner sees the answers it records and can change them.
These features do not make decisions that produce legal effects about people solely by automated means. Even so, you have the right to object if you believe an outcome against you arose solely from automated analysis of your data (section 11).
11. Your rights
Under Article 11 of the KVKK, you have the right to apply to the controller to:
- learn whether your personal data is processed,
- request information about it if it is,
- learn the purpose of processing and whether the data is used for that purpose,
- know the third parties in Turkey or abroad to whom it is transferred,
- request correction if it is incomplete or inaccurate,
- request its deletion or destruction under the conditions of Article 7 of the KVKK,
- request that the third parties to whom it was transferred be notified of a correction, deletion or destruction,
- object to an outcome against you arising from analysis of the data exclusively by automated systems,
- claim compensation if you suffer damage because of unlawful processing.
12. How to apply
To exercise your rights, under the Communiqué on the Procedures and Principles of Application to the Data Controller you can send your request in one of these ways:
- by a petition with your wet signature, in person or through a notary, to GÖRELE MAH. USTA SK. NO: 28 İÇ KAPI NO: 1 BEYKOZ/İSTANBUL,
- by registered electronic mail (KEP) to ironlabsteknoloji@hs06.kep.tr,
- signed with a secure electronic signature or mobile signature, or from the email address you previously gave Eventora and that is registered in our system, to kvkk@eventora.com.tr.
Your request must include your name, your signature if it is written, your Turkish ID number if you are a Turkish citizen or, if you are not, your nationality and passport number (and identity number, if any), your residential or business address for notices, your email address and phone number if any, and the subject of your request. You can use the Data Subject Request Form for this.
We conclude your request free of charge as soon as possible, depending on its nature, and within 30 days at the latest. If the request involves an additional cost, a fee may be charged under the tariff set in the Communiqué. If your request is refused, you find the answer insufficient, or no answer is given in time, you can complain to the Personal Data Protection Board within 30 days of learning the answer, and in any case within 60 days of your request.
13. Changes
We update this notice when our service or the law changes. The current notice is always published on this page, with the date of the last update at the top. We also announce material changes to account holders in the app or by email.